instantly-security-basics

Apply Instantly.ai security best practices for API keys, scopes, and access control. Use when securing API keys, implementing least-privilege access, or auditing Instantly workspace permissions. Trigger with phrases like "instantly security", "instantly api key safety", "instantly least privilege", "secure instantly", "instantly access control".

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./plugins/saas-packs/instantly-pack/skills/instantly-security-basics/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is concrete and actionable with strong code examples across six security topics, but it reads as an inline reference rather than a progressive-disclosure overview. Destructive operations lack validation checkpoints, capping workflow clarity.

Suggestions

Add explicit validation/confirmation steps before destructive calls (e.g. confirm member identity and role before removeMember, verify no active integrations use a key before DELETE) to lift workflow clarity above 3.

Split the bulk of the per-step API reference (endpoints, scope tables, rotation/audit snippets) into a references/ file and link to it from SKILL.md so the overview stays one level deep.

Make every Resources entry an actual link with a short purpose note, and standardize on one HTTP client pattern (InstantlyClient vs the instantly() helper) so code examples are copy-paste ready.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean with concrete code and avoids explaining basics Claude already knows, though inline comments and a few repeated scope tables add minor padding that could be trimmed.	4 / 5
Actionability	Concrete TypeScript snippets with specific endpoints and scope patterns (e.g. "campaigns:read", "DELETE /api/v2/api-keys/{id}") give mostly executable guidance, but mixed use of undefined helpers (InstantlyClient vs instantly()) prevents fully copy-paste-ready code.	4 / 5
Workflow Clarity	The six numbered steps are sequenced and key rotation includes a verify step, but destructive operations like removeMember and old-key deletion lack explicit validation checkpoints, capping this at 3 per the destructive-operation rule.	3 / 5
Progressive Disclosure	The file is well-sectioned but everything is inlined in one ~230-line document with no bundle files; two of three Resources entries are plain-text labels rather than signaled links, so structure is present but references are not clearly surfaced.	3 / 5
	Total	14 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it explicitly covers both what the skill does and when to use it, with concrete, product-specific trigger phrases. Minor tightening of trigger naturalness and coverage would push specificity and trigger quality to the top anchor.

Dimension	Reasoning	Score
Specificity	"Apply Instantly.ai security best practices for API keys, scopes, and access control" and "securing API keys, implementing least-privilege access, or auditing Instantly workspace permissions" name several concrete actions, but the coverage is broad rather than exhaustive, leaving minor gaps.	4 / 5
Completeness	It clearly states the "what" ("Apply Instantly.ai security best practices for API keys, scopes, and access control") and the "when" ("Use when securing API keys, implementing least-privilege access, or auditing...") with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Explicit triggers like "instantly security", "instantly api key safety", "secure instantly", and "instantly access control" give good natural keyword coverage, though a few are slightly contrived and synonyms/extensions are not comprehensive enough for a 5.	4 / 5
Distinctiveness Conflict Risk	The Instantly.ai product niche with scoped triggers ("instantly api key safety", "instantly least privilege") is clearly distinct and unlikely to fire for unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: jeremylongshore/claude-code-plugins-plus-skills
Path: plugins/saas-packs/instantly-pack/skills/instantly-security-basics/SKILL.md
Commit: 0540a62

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.